KVKK Disclosure Notice

Under Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS] (MERSIS [MERSIS NUMBER], [TAX OFFICE] tax office, tax number [TAX NUMBER]). VERBIS registration status: [VERBIS REGISTRATION STATUS].

• Identity and contact data: name (optional) and email address.
• Transaction security data: authentication records, session data, audit events, and IP address.
• Customer transaction data: workspace membership, uploaded datasets, analyses, decisions, and reports.

To create and operate your account and workspace, to deliver the decision analysis you request, to keep the service secure and prevent unauthorised access, to fulfil our contractual and legal obligations, and to respond to your requests.

• Necessity for the establishment or performance of a contract (art. 5/2-c).
• Compliance with a legal obligation (art. 5/2-ç).
• Legitimate interests of the controller, provided your fundamental rights are not harmed (art. 5/2-f) — used for security, abuse prevention, and the audit trail.

Data is collected electronically, through the ADE web application: the forms you complete, the files you upload, and the automatic records produced when you use the service.

Personal data is transferred to the service providers below, which host and operate parts of the platform. Where a provider is located outside Türkiye, the transfer is made under the conditions in KVKK art. 9. [CROSS-BORDER TRANSFER MECHANISM TO BE CONFIRMED: EXPLICIT CONSENT, UNDERTAKING, OR STANDARD CONTRACT]

• Supabase — Authentication, Postgres database, and file storage. ([SUPABASE REGION])
• Vercel — Application hosting, edge routing, and request logs. ([VERCEL REGION])
• [EMAIL PROVIDER] — Transactional email: account confirmation, invitations, password recovery. ([EMAIL PROVIDER REGION])

• Retained while the account is active, and deleted within 30 days of account deletion.
• Datasets, analyses, decisions, and reports are retained while the workspace exists, and are deleted with it.
• Audit records are retained for 12 months for security and dispute resolution.
• Operational logs are retained for up to 30 days.

You have the right to learn whether your personal data is processed, to request information about the processing, to learn its purpose and whether it is used accordingly, to know the third parties to whom it is transferred, to request correction or deletion, to request that these be notified to transferees, to object to a result produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing.

Applications are made under the Communiqué on Application Procedures to [PRIVACY CONTACT EMAIL], to [KEP ADDRESS], or in writing to [REGISTERED ADDRESS]. We respond within 30 days at the latest.

If the datasets you upload contain personal data belonging to your own customers or staff, you are the controller for that data and ADE acts as your processor. You are responsible for having a lawful basis and for informing those individuals.